Loading story…
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970, a critical improper neutralization vulnerability rated 9.9 on CVSS v3.1. Under certain conditions, an authenticated user with Duo Agent Platform access could submit a specially crafted flow configuration, escape the prompt template sandbox, and execute arbitrary commands on the AI Gateway. GitLab conducted targeted customer outreach before announcing the patches; the supplied notices do not report exploitation.
GitLab strongly recommends that affected Self-Hosted AI Gateway installations upgrade immediately to the applicable patched version. GitLab-hosted AI Gateways have already been patched, so GitLab.com, GitLab Dedicated, and GitLab Self-Managed customers using those hosted gateways need no action. The Canadian Centre for Cyber Security reinforced the update guidance in advisory AV26-994, identifying affected releases preceding the three fixed versions and urging administrators to review GitLab’s guidance and apply necessary updates.
Track how attackers are adapting to this technology.
6 events from the most recent confirmed update back to the earliest known activity.
CISA added an assessment to the CVE-2026-90970 record listing exploitation as "none," rather than public proof of concept or active exploitation. GitLab's advisory did not state whether the vulnerability had been exploited.
The Canadian Centre for Cyber Security issued advisory AV26-994 concerning the GitLab AI Gateway vulnerability and linked to GitLab's critical patch release. It encouraged users and administrators to review the guidance and apply necessary updates.
GitLab released AI Gateway versions 19.2.4, 19.3.2, and 19.4.1 to fix CVE-2026-90970, rated critical with a CVSS v3.1 score of 9.9, and urged affected Self-Hosted customers to upgrade immediately. Under certain conditions, an authenticated user with Duo Agent Platform access could use a crafted flow configuration to escape the prompt template sandbox and execute arbitrary commands on the gateway.
Before publishing its release announcement, GitLab conducted targeted outreach to Self-Hosted AI Gateway customers with upgrade guidance.
GitLab deployed the security fix to GitLab-hosted AI Gateways before announcing the release. GitLab.com, GitLab Dedicated, and GitLab Self-Managed customers using those hosted gateways did not need to take action.
Researcher invisiblemeerkat responsibly disclosed CVE-2026-90970, an improper neutralization vulnerability in the GitLab AI Gateway custom flow prompt template. GitLab credited the researcher in its patch announcement.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
4 references tracked. Mallory keeps watching after this page renders.
malware.news
Open sourcecyber.gc.ca
Open sourcethehackernews.com
Open sourcedocs.gitlab.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
GitLab remediated **CVE-2026-1868**, a critical flaw in the *Duo Workflow Service* component of **GitLab AI Gateway** caused by improper neutralization during template expansion of user-supplied data. By submitting crafted **Duo Agent Platform Flow definitions**, an attacker could trigger **denial of service** or potentially achieve **remote code execution (RCE)** on the AI Gateway, turning the AI workflow feature into an execution path on the underlying gateway service. The issue impacts self-hosted GitLab AI Gateway deployments across multiple version tracks, including versions starting at **18.1.6**, **18.2.6**, and **18.3.1** up to vulnerable releases such as **18.6.1**, **18.7.0**, and **18.8.0**. GitLab released fixes in **18.6.2**, **18.7.1**, and **18.8.1**; exploitation requires **authenticated access** to the GitLab instance (e.g., a compromised developer account or malicious insider), and GitLab reported the issue was discovered internally (by a GitLab team member, per reporting).
Jun 29, 2026
GitLab released security updates `17.3.2`, `17.2.5`, and `17.1.7` for self-managed Community Edition and Enterprise Edition instances, fixing 18 vulnerabilities including a critical issue tracked as `CVE-2024-6678` with a CVSS score of 9.9. The flaw could let an attacker trigger a CI/CD pipeline as an arbitrary user and perform a stop action under certain conditions. GitLab said GitLab.com is already running the patched version and GitLab Dedicated customers do not need to take action. The release also fixes several high-severity bugs, including command injection into a connected Cube server via YAML configuration (`CVE-2024-8640`), server-side request forgery through Maven Dependency Proxy requests to internal resources (`CVE-2024-8635`), and a denial-of-service condition caused by a crafted POST request or large `glm_source` parameter (`CVE-2024-8124`). Additional medium-severity patches address token and session abuse, permission bypasses, information disclosure, and open redirects that could contribute to account takeover through broken OAuth flows, and GitLab urged all self-managed administrators to upgrade immediately.
Jul 24, 2026
GitLab released CE and EE versions **19.3.1**, **19.2.5**, and **19.1.7** to remediate seven security vulnerabilities, led by **CVE-2026-18252** (CVSS 8.7). The flaw lets an authenticated GitLab EE user with Developer privileges execute arbitrary commands in CI contexts by abusing user-controlled configuration processed by the GitLab Duo Claude AI agent. Affected EE releases span 18.9 through 19.1.6, 19.2 through 19.2.4, and 19.3 prior to 19.3.1; no workaround is available. The patches also resolve authenticated denial-of-service issues involving background-job processing and SCIM provisioning, plus authorization and access-control weaknesses. GitLab.com and GitLab Dedicated are already patched, while self-managed customers should upgrade immediately; single-node deployments should plan for downtime while database migrations complete, whereas correctly configured multi-node deployments can use zero-downtime upgrade procedures. No exploitation of CVE-2026-18252 has been publicly confirmed.
Aug 28, 2026